Symantec endpoint protection - USB allow on time base

I am using symantec endpoint protection. some of our users or guest require usb access just for data transfer to computer/laptop. In this scenario each & every time i need to open console transfer from one group to another (usb allow) group update policy from client then user can transfer data

There should be policy for usb allow for few minutes. when ever its connect to server again (depend upon heartbeat interval) usb is automatically block.